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Purpose and restrictions of 

presentation 

Relating to ETSI standards for LI 

Focusing on state of the art legislations 

Less about what is done within the 
intelligence community 

Some discussion about technical futures 
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The traditional way of doing 

interception 

• "Reptile stage" = alligator clips & headphones 

• Legal framework = specific phone no 

• Paper-bound provisioning 

• Results on paper & floppy 

• Analysis by reading & listening 
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New services - new challenges 



Digital telephony transmission 
Wireless telephony 
Internet communication 
IP-based services (Chat, video etc) 
Information societies (eg Facebook) 
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Why use standards for LI? 


Pros: 


Cons: 


• 


Uniform interfacing 


• Tends to lag behind 


• 


Proven technology 


• Initial investments 


• 


Interoperability 




• 


Commercially available 


• Requires training 




equipment 


• Adaptation costs 


• 


Change control 


• System load 


• 


Transferable technology 




• 


Managed security 
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The issues for Lawful Interception 



Finding a suitable point of interception 
Defining a relevant target id 
Filtering out irrelevant information 
Handling encrypted information 
Dealing with globalization 
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Intercepting CS telephony 
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LEA 



NWO/AP/SvPQ domain 



domain 





Source: ETSI TS 101671 
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Generalized model 



COT 

Cecratech 



I CSP DOMAIN I 




Intercept Related 
Information Internal 
Interception 
Function (IRI-IIF) 



1 



Content of 
Communication 
Trigger Function 

(CCTF) 



CCTI 



CCCI 



Content of 
Communication 
Internal Interception 
Function (CC-IIF) 
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Lawful 

Interception 

Mediation 

Function 

(MF) 



HI 



LEA 



HI1 



HI2 



HI3 



LEA 

Admini stration 
Function 



Law T 

Enforcement 

Monitoring 

Facility 

(LEMF) 



Source: ETSI TR 102528 
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Finding targets in CS telephony 



Phone number 

IMSI 

IMEI 

Location? 

Link layer analysis (El tapping) 
Trojans in customer equipment (?) 
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Intercepting IP traffic 
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Call Agent 
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Intercepting IP telephony 
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1) IMS or IMS-like Architecture 2) SIP Proxy Architecture 




3) SIP Re-direct Architecture 4) P2P SIP Architecture 
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Finding targets in IP telephony 



Phone number (in Softswitch) 
Phone number (SI P/line tapping) 

IP address (line tapping) 

Delivery of intercept results to LEA 

-Telephony 
- IP packets 
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Intercepting e-mail 
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• Line tapping 
- IP address 
-TCP port 

— Mail header 

• Server interception 
— Mail address 

— Mailbox id 

— Mail folders (webmail/IMAP) 
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Intercepting IP multimedia 

Chat 
Video 
Audio 
MMS 

Web browsing 
File transfer 



2 Oct 2008 



Stefan Bjornson rev 1 



14 



ETSltfrf^_ 



~7W 



eer 

Cecratech 



Finding targets in IP multimedia 



Phone number (GPRS intercept) 
IP address 

User id (server intercept) 
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Smart targeting 
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Electronic provisioning & delivery 
Identity profiling 
Voice recognition 

Spotting keywords in communication 



>What about personal integrity? 
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